WO2013086758A1 - Ethernet encryption and authentication system and method - Google Patents

Abstract

An Ethernet encryption and authentication system and method. The system comprises an encryption switch and an encryption network card installed in a client host. The encryption network card comprises: an EEPROM memory with SHA-1, used for storing a serial number and a key of the encryption network card and generating a message authentication code according to the serial number, the key, and user-defined data; a CPLD, used for generating a random number and further generating a control word for encrypting an important data packet; and a network control chip, respectively connected to the EEPROM memory with SHA-1 and the CPLD, and used for controlling an Ethernet interface. The encryption switch comprises: an SHA-1 coprocessor, used for storing a serial number and a key of the encryption switch, generating a random number, and further generating a message authentication code according to the serial number, the key, and the random number. The present invention can ensure the real-time availability of the encrypted network, has high security, is difficult to be cracked or monitored, and reduces the Ethernet encryption and authentication costs.

Description

 Ethernet encryption authentication system and encryption authentication method

Technical field

The present invention relates to the field of Ethernet encryption authentication technologies, and in particular, to an Ethernet encryption authentication system and an encryption authentication method.

Background technique

Ethernet encryption technology is mainly used to prevent illegal computers from accessing the organization's internal LAN to steal confidential information. This technology can also prevent the interconnection of office computers and other illegal computers in the organization to create confidential data. Key devices in Ethernet encryption technology include Ethernet encryption switches and Ethernet encryption network cards. The prior art typically encrypts and decrypts Ethernet data at an encryption switch and an encrypted network card by hardware or software.

The hardware encryption technology mainly encrypts and decrypts the data on the MII/GMII interface by adding an FPGA device between the network controller (MAC) chip and the PHY chip on the side of the encryption network card, and the switching chip (MAC) on the side of the encryption switch. The FPGA device is also inserted between the PHY and the PHY to perform reverse encryption and decryption operations on the data on the MII/GMII interface. This type of technology requires large-scale insertion of FPGA devices between the MAC and the PHY. The cost is high, and the number of authentications is limited. Real-time authentication is not possible, so the security is poor. In addition, the encryption algorithm is relatively fixed inside the FPGA. Once it is cracked, it will be Make other devices vulnerable as well.

The software encryption technology uses the processing capability of the processor to encrypt and decrypt Ethernet packets or their upper-layer messages on the encrypted network card side and the encryption switch side. This kind of technology is easy to be disassembled, tracked and deciphered by malicious people, and the security is poor, and its encryption algorithm is fixed, which is easy to crack through interception; in addition, the encryption and decryption operation of the software requires a lot of CPU processing power, which will reduce the throughput of the network. Performance and processing power of the device.

Summary of the invention

The technical problem to be solved by the present invention is how to ensure the real-time availability of the encrypted network, how to improve the security performance of the system, make it difficult to be cracked or monitored, and how to reduce the cost of Ethernet encryption authentication.

To solve the above problem, the present invention provides an Ethernet encryption authentication system, including an encryption switch and an encryption network card installed on a client host; the encryption network card includes:

An EEPROM memory with SHA-1, configured to store a serial number and a key of the encrypted network card, and generate a message authentication code according to the serial number, the key, and the user-defined data;

a CPLD for generating a random number and generating a control word for encrypting important data packets;

a network control chip respectively connected to the EEPROM memory with SHA-1 and a CPLD for controlling an Ethernet interface;

The encryption switch includes: a SHA-1 coprocessor for storing a serial number and a key of the encryption switch, generating a random number, and generating a message authentication code according to the sequence number, the key, and the random number.

Preferably, the network control chip is provided with an extended IIC interface, a GPIO and a PCIe interface.

Preferably, the network control chip is an intel 82574 chip, and may also be other network control chips that meet functional requirements.

The present invention also provides a method for performing authentication of a host by an encryption switch by using the foregoing system, including the following steps:

A: When the encryption switch discovers that a new host is connected to its network interface, it sends a custom message to the host, requesting it to provide the serial number of the encrypted network card;

B: The host communicates with the EEPROM memory with SHA-1 on the encrypted network card through the network card control chip, and reads the serial number of the encrypted network card and sends it to the encryption switch;

C: The SHA-1 coprocessor on the encryption switch generates a random number and a challenge message and sends the message to the host, and generates a verification message authentication code according to the random number, the serial number of the encrypted network card, and the key;

D: After receiving the challenge message, the host sends it to the EEPROM memory with SHA-1 on the encrypted network card.

E: The EEPROM memory with SHA-1 generates a message authentication code according to the received random number, the serial number of the encrypted network card, and the key;

F: The host encapsulates the message authentication code generated by the encrypted network card into a response message and sends the message to the encryption switch.

G: The encryption switch compares the authentication message authentication code generated by the encryption switch with the message authentication code sent by the host. If the two are consistent, the network exchange service is provided for the host. Otherwise, the port connected to the host is closed.

Even for authenticated hosts, the cryptographic switch can initiate an authentication process for it at regular intervals (such as a few minutes), and if it does, continue to provide services to it, otherwise it is isolated from the rest of the network.

The present invention also provides a method for performing host-to-encryption switch authentication by using the foregoing system, comprising the following steps:

A1: The host detects that it establishes a connection with the encryption switch, sends a message requesting the encryption switch to provide the network card serial number, the encryption switch communicates with the SHA-1 coprocessor, reads the network card serial number and sends the network card serial number to the host;

B1: The CPLD generates a random number, and the EEPROM memory with SHA-1 reads the serial number of the network card, and encapsulates the random number and the serial number of the network card into the challenge message and sends it to the encryption switch;

C1: The host sends the random number generated by the CPLD to the EEPROM memory with SHA-1, and the EEPROM memory with SHA-1 calculates the verification message authentication code according to the random number, the network card serial number and the key;

D1: The encryption switch sends the network card serial number and the random number in the challenge message received by the switch to the SHA-1 coprocessor, and the SHA-1 coprocessor calculates the message authentication code according to the random number, the network card serial number and the key. ;

E1: The encryption switch encapsulates the calculated message authentication code into the response message and sends the message to the host.

F1: The host sends the received message authentication code and the verification message authentication code to the CPLD for comparison. If the two are consistent, the encryption switch is used to provide the network switching service. Otherwise, the CPLD will close the network connection of the network card.

The present invention also provides a method for performing mutual authentication between an encrypted network card driver (a driver can have various implementations, including a driver, etc.) and an encrypted network card by using the foregoing system, including the following steps:

A2: Insert a USB KEY including a SHA-1 Coprocessor in the PCI slot or USB interface of the host;

B2: the encrypted network card driver sends a request to read the serial number to the encrypted network card, and reads the serial number and sends it to the USB KEY;

C2: the encrypted network card driver requests the USB KEY to generate a random number, and reads the random number to send to the encrypted network card;

D2: The EEPROM memory with SHA-1 generates a message authentication code according to the key, the random number and the serial number of the encrypted network card, and is read back by the encrypted network card driver;

E2: USB KEY Generating a verification message authentication code according to the key, the random number, and the serial number of the encrypted network card, and reading back by the encrypted network card driver;

F2: The encrypted network card driver compares the message authentication code with the verification message authentication code, and if the two are consistent, the network connection is continued to be used; otherwise, the network connection is stopped.

Preferably, the above method further comprises: using a CPLD maintenance timer to supervise the step of authenticating the encrypted network card by the encrypted network card driver timing. If the timer expires and the host software is illegal or does not function properly, the CPLD will disconnect the network connection of the network card. This is actually the authentication process for the host software.

The invention also provides a method for encrypting and decrypting data messages by using the foregoing system, comprising the following steps:

A3: After the encryption switch authenticates the host, the EEPROM memory with SHA-1 on the encrypted network card generates a message authentication code;

B3: The CPLD on the encrypted network card converts the message authentication code into a control word, and the encrypted network card uses the control word to encrypt and decrypt the data message;

C3: The encryption switch uses the same algorithm as the CPLD to generate the same control word to encrypt and decrypt the data packets of the host.

The foregoing technical solution has the following advantages: the invention strengthens the authentication link of the Ethernet encryption, and saves the cost compared with the traditional hardware encryption technology, and the authentication method of the invention can be repeated periodically to ensure the real-time availability of the encrypted network; The present invention is more efficient than the traditional software encryption technology, and does not occupy CPU and memory resources excessively. The present invention provides a reverse authentication mechanism for the host to the encryption switch, ensuring that devices in each network can perform operations on the peer device. Verification; the present invention has sufficient protection for the encrypted and authenticated keys, and even if a device in the network is monitored, the encryption and authentication algorithms are not easily deciphered; in the present invention, each device in the encrypted Ethernet local area network has The global unique identifier, plus the use of random numbers for each authentication to generate the message authentication code, ensures that the message authentication code generated by each host at different times will not be the same, which further improves the difficulty of monitoring and deciphering.

DRAWINGS

1 is a schematic structural diagram of an Ethernet encryption and authentication system according to an embodiment of the present invention;

2 is a flowchart of a method for performing authentication of a host by an encryption switch according to an embodiment of the present invention;

3 is a flowchart of a method for performing host-to-encryption switch authentication according to an embodiment of the present invention;

4 is a flowchart of a method for performing mutual authentication between an encrypted network card driver and an encrypted network card according to an embodiment of the present invention;

FIG. 5 is a flowchart of a method for encrypting and decrypting a data packet according to an embodiment of the present invention.

detailed description

The following examples are intended to illustrate the invention but are not intended to limit the scope of the invention.

As shown in FIG. 1 , an Ethernet encryption and authentication system according to the present invention includes an encryption switch and an encrypted network card installed on a client host; the encrypted network card includes:

An EEPROM memory with SHA-1, configured to store a serial number and a key of the encrypted network card, and generate a message authentication code according to the serial number, the key, and the user-defined data;

a CPLD for generating a random number and generating a control word for encrypting important data packets;

The network control chip is respectively connected to the EEPROM memory with the SHA-1 and the CPLD for controlling the Ethernet interface, and the network control chip is provided with an extended IIC interface, a GPIO and a PCIe interface. The network control chip is intel The 82574 chip can also be other network control chips that meet the functional requirements;

The encryption switch includes: a SHA-1 coprocessor for storing a serial number and a key of the encryption switch, generating a random number, and generating a message authentication code according to the sequence number, the key, and the random number.

As shown in FIG. 2, a method for performing authentication of a host by an encryption switch by using the foregoing system includes the following steps:

A: When the encryption switch discovers that a new host is connected to its network interface, it sends a custom message to the host, requesting it to provide the serial number of the encrypted network card;

B: The host communicates with the EEPROM memory with SHA-1 on the encrypted network card through the network card control chip, and reads the serial number of the encrypted network card and sends it to the encryption switch;

C: The SHA-1 coprocessor on the encryption switch generates a random number and a challenge message and sends the message to the host, and generates a verification message authentication code according to the random number, the serial number of the encrypted network card, and the key;

D: After receiving the challenge message, the host sends it to the EEPROM memory with SHA-1 on the encrypted network card.

E: The EEPROM memory with SHA-1 generates a message authentication code according to the received random number, the serial number of the encrypted network card, and the key;

F: The host encapsulates the message authentication code generated by the encrypted network card into a response message and sends the message to the encryption switch.

G: The encryption switch compares the authentication message authentication code generated by the encryption switch with the message authentication code sent by the host. If the two are consistent, the network exchange service is provided for the host. Otherwise, the port connected to the host is closed.

Even for authenticated hosts, the cryptographic switch can initiate an authentication process for it at regular intervals (such as a few minutes), and if it does, continue to provide services to it, otherwise it is isolated from the rest of the network.

As shown in FIG. 3, a method for authenticating a host to an encryption switch by using the foregoing system includes the following steps:

A1: The host detects that it establishes a connection with the encryption switch, sends a message requesting the encryption switch to provide the network card serial number, the encryption switch communicates with the SHA-1 coprocessor, reads the network card serial number and sends the network card serial number to the host;

B1: The CPLD generates a random number, and the EEPROM memory with SHA-1 reads the serial number of the network card, and encapsulates the random number and the serial number of the network card into the challenge message and sends it to the encryption switch;

C1: The host sends the random number generated by the CPLD to the EEPROM memory with SHA-1, and the EEPROM memory with SHA-1 calculates the verification message authentication code according to the random number, the network card serial number and the key;

D1: The encryption switch sends the network card serial number and the random number in the challenge message received by the switch to the SHA-1 coprocessor, and the SHA-1 coprocessor calculates the message authentication code according to the random number, the network card serial number and the key. ;

E1: The encryption switch encapsulates the calculated message authentication code into the response message and sends the message to the host.

F1: The host sends the received message authentication code and the verification message authentication code to the CPLD for comparison. If the two are consistent, the encryption switch is used to provide the network switching service. Otherwise, the CPLD will close the network connection of the network card.

As shown in FIG. 4, a method for performing mutual authentication between an encrypted network card driver and an encrypted network card by using the foregoing system includes the following steps:

A2: Insert a USB KEY including a SHA-1 Coprocessor in the PCI slot or USB interface of the host;

B2: the encrypted network card driver sends a request to read the serial number to the encrypted network card, and reads the serial number and sends it to the USB KEY;

C2: the encrypted network card driver requests the USB KEY to generate a random number, and reads the random number to send to the encrypted network card;

D2: The EEPROM memory with SHA-1 generates a message authentication code according to the key, the random number and the serial number of the encrypted network card, and is read back by the encrypted network card driver;

E2: The USB KEY generates a verification message authentication code according to the key, the random number and the serial number of the encrypted network card, and is read back by the encrypted network card driver;

F2: The encrypted network card driver compares the message authentication code with the verification message authentication code, and if the two are consistent, the network connection is continued to be used; otherwise, the network connection is stopped.

After the encrypted network card is installed in the host, a legal network card driver must be installed to implement the authentication process and properly control the encrypted network card. The encrypted network card can work normally. The network card driver running on the host needs to be authenticated with the installed encrypted network card. In order to ensure that the other party is legal and normal, the network connection can be used normally. Otherwise, the encrypted network card is used together with the ordinary network card driver or the host that has installed the correct encrypted network card driver has not installed the ordinary network card. The expected security effect, once found to be the case, should immediately ban the use of the network connection.

Preferably, the above method further comprises: using a CPLD maintenance timer to supervise the step of authenticating the encrypted network card by the encrypted network card driver timing. If the timer expires and the host software is illegal or does not function properly, the CPLD will disconnect the network connection of the network card. This is actually the authentication process for the host software.

As shown in FIG. 5, a method for encrypting and decrypting a data message by using the foregoing system includes the following steps:

A3: After the encryption switch authenticates the host, the EEPROM memory with SHA-1 on the encrypted network card generates a message authentication code;

B3: The CPLD on the encrypted network card converts the message authentication code into a control word, and the encrypted network card uses the control word to encrypt and decrypt the data message;

C3: The encryption switch uses the same algorithm as the CPLD to generate the same control word to encrypt and decrypt the data packets of the host.

Because each time the encryption switch re-authenticates the host, the value of the message authentication code changes, and the value of the control word changes. The network card of each host has a global unique serial number, thus ensuring encryption control. Words change with different hosts at different times. Even if the network is monitored, it is difficult to completely decipher the message key and encryption mechanism.

The method of software encryption and decryption consumes a lot of CPU processing power and memory resources, and reduces the processing power and network throughput of the host and the encryption switch. Therefore, it is recommended to use only this method to encrypt key data packets. If you want to encrypt all the messages, a more effective method is to use hardware acceleration scheme, which uses FPGA or special hardware acceleration chip, which greatly increases the cost.

Industrial applicability

The invention provides an Ethernet encryption authentication system and an encryption authentication method, which can ensure real-time availability of an encrypted network; improve system security performance, make the system difficult to be cracked or monitored; reduce the cost of Ethernet encryption authentication, and have industrial practicality Sex.

Claims (1)

Claims: An Ethernet encryption authentication system, comprising: an encryption switch and an encryption network card installed on the client host; the encryption network card includes: An EEPROM memory with SHA-1, configured to store a serial number and a key of the encrypted network card, and generate a message authentication code according to the serial number, the key, and the user-defined data; a CPLD for generating a random number and generating a control word for encrypting important data packets; a network control chip respectively connected to the EEPROM memory with SHA-1 and a CPLD for controlling an Ethernet interface; The encryption switch includes: a SHA-1 coprocessor for storing a serial number and a key of the encryption switch, generating a random number, and generating a message authentication code according to the sequence number, the key, and the random number. 2. The Ethernet encryption authentication system of claim 1, wherein the network control chip is provided with an extended IIC interface, a GPIO, and a PCIe interface. The Ethernet encryption authentication system according to claim 1 or 2, wherein the network control chip is intel 82574 chip. A method for authenticating a host by an encryption switch using the system according to any one of claims 1 to 3, characterized in that it comprises the following steps: A: When the encryption switch discovers that a new host is connected to its network interface, it sends a custom message to the host, requesting it to provide the serial number of the encrypted network card; B: The host communicates with the EEPROM memory with SHA-1 on the encrypted network card through the network card control chip, and reads the serial number of the encrypted network card and sends it to the encryption switch; C: The SHA-1 coprocessor on the encryption switch generates a random number and a challenge message and sends the message to the host, and generates a verification message authentication code according to the random number, the serial number of the encrypted network card, and the key; D: After receiving the challenge message, the host sends it to the EEPROM memory with SHA-1 on the encrypted network card. E: The EEPROM memory with SHA-1 generates a message authentication code according to the received random number, the serial number of the encrypted network card, and the key; F: The host encapsulates the message authentication code generated by the encrypted network card into a response message and sends it to the encryption exchange. machine; G: The encryption switch compares the authentication message authentication code generated by the encryption switch with the message authentication code sent by the host. If the two are consistent, the network exchange service is provided for the host. Otherwise, the port connected to the host is closed. A method for authenticating a host-to-encryption switch using the system of any one of claims 1-3, comprising the steps of: A1: The host detects that it establishes a connection with the encryption switch, sends a message requesting the encryption switch to provide the network card serial number, the encryption switch communicates with the SHA-1 coprocessor, reads the network card serial number and sends the network card serial number to the host; B1: The CPLD generates a random number, and the EEPROM memory with SHA-1 reads the serial number of the network card, and encapsulates the random number and the serial number of the network card into the challenge message and sends it to the encryption switch; C1: The host sends the random number generated by the CPLD to the EEPROM memory with SHA-1, and the EEPROM memory with SHA-1 calculates the verification message authentication code according to the random number, the network card serial number and the key; D1: The encryption switch sends the network card serial number and the random number in the challenge message received by the switch to the SHA-1 coprocessor, and the SHA-1 coprocessor calculates the message authentication code according to the random number, the network card serial number and the key. ; E1: The encryption switch encapsulates the calculated message authentication code into the response message and sends the message to the host. F1: The host sends the received message authentication code and the verification message authentication code to the CPLD for comparison. If the two are consistent, the encryption switch is used to provide the network switching service. Otherwise, the CPLD will close the network connection of the network card. A method for mutual authentication between an encrypted network card driver and an encrypted network card by using the system of any one of claims 1 to 3, characterized in that it comprises the following steps: A2: Insert a USB KEY including a SHA-1 Coprocessor in the PCI slot or USB interface of the host; B2: the encrypted network card driver sends a request to read the serial number to the encrypted network card, and reads the serial number and sends it to the USB KEY; C2: The encrypted network card driver requests the USB KEY to generate a random number and reads the random number to send Give an encrypted network card; D2: The EEPROM memory with SHA-1 generates a message authentication code according to the key, the random number and the serial number of the encrypted network card, and is read back by the encrypted network card driver; E2: USB KEY Generating a verification message authentication code according to the key, the random number, and the serial number of the encrypted network card, and reading back by the encrypted network card driver; F2: The encrypted network card driver compares the message authentication code with the verification message authentication code, and if the two are consistent, the network connection is continued to be used; otherwise, the network connection is stopped. 7. The method of performing mutual authentication between an encrypted network card driver and an encrypted network card according to claim 6, further comprising the step of: using a CPLD maintenance timer to supervise the authentication of the encrypted network card by the encrypted network card driver. A method for encrypting and decrypting a data message by using the system according to any one of claims 1 to 3, characterized in that it comprises the following steps: A3: After the encryption switch authenticates the host, the EEPROM memory with SHA-1 on the encrypted network card generates a message authentication code; B3: The CPLD on the encrypted network card converts the message authentication code into a control word, and the encrypted network card uses the control word to encrypt and decrypt the data message; C3: The encryption switch uses the same algorithm as the CPLD to generate the same control word to encrypt and decrypt the data packets of the host.

Images